Disk encryption

New ShedOS installs are encrypted by default. The whole system — your files, your home, the swap used for hibernation — sits inside a LUKS2 container, so a lost, stolen, or seized machine gives up nothing without your key. You can turn it off at install time if you want to.

Your two keys

At the partitioning step you set a passphrase. You type it once per boot to unlock the disk. ShedOS also generates a recovery key — a long random code shown on its own screen during the install, with a checkbox you have to tick to confirm you wrote it down.

These are the only two ways in. There is no backdoor and no reset:

• The passphrase is what you use day to day.
• The recovery key is the spare. If you forget the passphrase, it is the one other thing that unlocks the disk.

Write the recovery key down and keep it somewhere safe and separate from the machine — a password manager on another device, or paper in a drawer. If you lose both the passphrase and the recovery key, the data is gone. Nobody — not you, not us — can recover it. That is the point of encryption.

Unlocking at boot

Every boot stops at a prompt before the system starts. Type your passphrase (or the recovery key) and it continues to the login screen as normal. Hibernation works too: the resume image is written to encrypted swap and unlocked the same way.

If typing the passphrase every boot gets old, you can bind the disk to this machine’s TPM2 so a trusted boot unlocks on its own — see Passwordless unlock.

Turning encryption off

At the partitioning step of the installer, the “Encrypt system” box is ticked by default. Untick it before you continue and the install is unencrypted — no passphrase at boot, no recovery key. You can always encrypt it in place later (see below).

Recovering an encrypted machine

If the system won’t boot and you need to get at your files, boot the ShedOS live USB and unlock the disk by hand:

# Replace /dev/nvme0n1p2 with your root partition (lsblk shows the layout).
cryptsetup open /dev/nvme0n1p2 root      # enter the passphrase or recovery key
mount -o subvol=@ /dev/mapper/root /mnt

With the disk unlocked and mounted, the usual recovery paths work as normal — the guided recovery tools, snapshot rollback, and the ESP repair runbook all operate on the unlocked root.

Encrypting an existing install

An unencrypted ShedOS box keeps working exactly as it is — an update never converts it. When you want to encrypt it, you don’t have to reinstall. shedman encrypt converts the running system in place, with no external drive and no copying your data off and back.

sudo shedman encrypt

It can’t rewrite the disk while the system is running on it, so nothing is encrypted on the spot. It runs a preflight, takes a passphrase, and arms the conversion. The next reboot does the real work — it rewrites the disk in a minimal environment while nothing is mounted, then boots back into your desktop encrypted. A full disk takes a while and the machine is unusable until it finishes, so start it when you can leave it alone and on AC power.

Only a standard ShedOS layout converts: a btrfs root on the @ subvolume. An already-encrypted or non-standard disk is turned away by the preflight before a byte is touched. A small encrypted swap is carved for hibernation too, unless you pass --no-swap.

Afterwards you have the same two keys as a fresh install: the passphrase you just set, and a recovery key the first login shows once. Write it down and keep it safe, exactly as you would at install.

A power cut mid-rewrite is the thing to avoid, which is why it wants AC power — but the rewrite is resumable, so if one happens the next boot picks up where it stopped and finishes. sudo shedman encrypt --status shows progress along the way, and --disarm cancels a conversion you armed but haven’t rebooted into yet.

Going further

Encryption is the first of three layers that build on each other. Secure Boot makes the firmware refuse any boot image this machine didn’t sign — read that page before touching the firmware’s Secure Boot switch, because the order matters. With both in place, passwordless unlock lets the TPM unlock the disk on a verified boot, so the passphrase prompt disappears entirely. And whenever you need to change a passphrase or rotate the recovery key, that’s key management.